CVE-2026-47121: Sparkle Package Binary Delta Apply Symlink Traversal Vulnerability
Summary
CVE-2026-47121: Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta. Affects github.com/sparkle-project/Sparkle versions < 2.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sparkle is an open-source software update framework for macOS applications, allowing developers to easily implement automatic updates. It provides features such as delta updates, which minimize the amount of data transferred during updates by only sending the changes. However, Sparkle has a vulnerability that allows attackers to exploit the delta update mechanism to write arbitrary files outside the intended directory structure, particularly when the AppInstaller runs with elevated privileges.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of symbolic links during the binary delta apply process. Specifically, the code does not adequately check for symlinks in the intermediate path components, allowing an attacker with a compromised EdDSA signing key to craft a malicious .delta file. This could lead to arbitrary file writes at the root level, enabling the attacker to place files in sensitive directories such as /Library/LaunchDaemons, which could be executed with root privileges. The issue is exacerbated by the fact that the AppInstaller may run as root, granting extensive access to the file system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the delta update feature until you can apply the patch. If you must use it, ensure that the signing keys are secure and not compromised. Additionally, consider running the AppInstaller with reduced privileges to limit the impact of any potential exploitation.
Conclusion
The CVE-2026-47121 vulnerability in the Sparkle package poses a significant risk due to its potential for arbitrary file writes when exploited. It is crucial for developers using Sparkle to update to the latest version and implement recommended security practices to safeguard their applications.
See every vulnerability recorded for github.com/sparkle-project/Sparkle →
FAQ
CVE-2026-47121 is a vulnerability in the Sparkle package that allows for symlink traversal during binary delta updates, potentially enabling arbitrary file writes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors for open-source vulnerabilities without requiring installation.
The vulnerability can lead to unauthorized file writes at root level, allowing attackers to execute malicious code or alter system configurations.
Yes, a patch is available in Sparkle version 2.9.2 and later. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update immediately, avoid using the delta update feature and ensure that your signing keys are secure to prevent exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sparkle-project/Sparkle.
